← Back to News
Innovation

Card networks lay the payment rails for AI shopping agents

Mastercard’s Agent Pay for Machines, Google’s AP2 protocol, and agentic tokens from Visa and Stripe now form a common stack for payments made by AI agents: tokenized, capped, and backed by signed mandates. Machine-to-machine transactions come next.

Networks mentionedAMEXCB

Agentic payments, purchases that an AI agent triggers and pays for on a user’s behalf, are moving past the demo stage. In June 2026, Mastercard launched Agent Pay for Machines, a service built for continuous, high-frequency payments between machines. Together with Google’s open AP2 protocol and the agentic tokens offered by Visa and Stripe, it points to a common architecture that took shape in just over a year: protocols handle the agent’s identity and intent, and the card networks move the money.

🔑
The agent never sees the card number
An AI agent never holds the cardholder’s card number. It receives an agentic token issued by the network, restricted by spending limit, merchant category and duration. Every purchase is bound by signed mandates that prove, after the fact, what the user authorized.

Mastercard and Stripe push agents beyond single-use cards

Until recently, agentic commerce meant single-use virtual cards. Two moves in 2026 went further. First, Mastercard Agent Pay for Machines targets agents that transact with one another, chaining microtransactions that are “settled at machine speed” across cards, accounts and stablecoins. More than 30 companies signed on at launch, including Adyen, Ant International, BVNK, Checkout.com, Cloudflare, Coinbase, Getnet by Santander, Global Payments, OKX, Stripe and Tempo. “Machine payments can make it possible for services to be bought and sold among agents at very high volumes, very small values, very fast,” said Jorn Lambert, Mastercard’s chief product officer. Second, Stripe had already widened support for its Shared Payment Tokens (SPTs) in March 2026. A single Stripe integration now reaches both Mastercard Agent Pay and Visa Intelligent Commerce.

Google, meanwhile, is promoting AP2 (Agent Payments Protocol), an open standard announced in September 2025 with more than 60 partners, including Mastercard, PayPal, American Express and Coinbase. AP2 defines three cryptographically signed mandates, expressed as W3C Verifiable Credentials. That pairing, an open protocol for intent and a network token for the money, is becoming the dominant pattern in production.

Humangrants a bounded mandateAI agentsearches, compares, negotiatesMerchant / APImachine-readable catalogmandate + limitdiscovery (feeds, MCP)Agent identityverifiable credentials · KYAPayment protocolAP2 · ACP · x402 (HTTP 402)Railsnetwork token · stablecoin · A2Aidentifies itselfpays via the protocolControlslimits, approved merchants, signed logsSettlementstandard authorization OR USDC/EURCEvidence & disputesenforceable mandate, agentic reason codesThe human sets the limits2025–2026 protocolsCard or stablecoin settlement

Every approach tokenizes, caps, and proves

CompanyProductHow it works
MastercardAgent Pay / Agent Pay for MachinesAgentic token plus machine-to-machine payments, including microtransactions and stablecoins
VisaIntelligent CommerceTokenized “AI-ready” card credentials, with spending-limit, merchant-category and real-time validation controls
StripeAgentic Commerce Suite (SPT + Agent Toolkit)Shared tokens and programmatically issued virtual cards, embedded in the agent’s code
GoogleAP2Open protocol: signed Intent, Cart and Payment mandates (Verifiable Credentials)
The agentic building blocks of the main players (mid-2026)

The approaches share the same logic: tokenize the sensitive data, cap what the agent can spend, and prove the authorization. AP2 splits every purchase into three mandates: the Intent Mandate (what the user wants), the Cart Mandate (the cart the agent assembles) and the Payment Mandate (what the merchant or the network will charge).

  • Intent Mandate: the user sets a goal and limits (“book a Paris–Lisbon flight under €250”).
  • Cart Mandate: the agent builds an actual cart and gets it approved, either explicitly or within the terms of the intent.
  • Payment Mandate: the final amount goes to the network, which triggers settlement through a dedicated token.
Rows of server cabinets in a data center
Agent Pay for Machines is built for continuous, high-frequency payments between machines.
Apr. 2025
Visa Intelligent Commerce
Visa opens its tokenized card credentials to AI agents.
Sept. 2025
AP2 (Google)
An open protocol for signed mandates, with 60+ partners including Mastercard and PayPal.
Mar. 2026
SPTs converge
Stripe extends Shared Payment Tokens to Mastercard Agent Pay and Visa Intelligent Commerce.
Apr. 2026
Intelligent Commerce Connect
Visa pitches an “on-ramp” that is agnostic to network, protocol and token vault.
June 2026
Agent Pay for Machines
Mastercard targets machine-to-machine payments, with 30+ partners at launch.
3
signed mandates per purchase in AP2
Google Cloud
60+
partners at AP2’s launch
Google Cloud
30+
companies backing Agent Pay for Machines
Mastercard

Liability, compliance, and settlement remain open questions

⚠️
No settled answer on liability and fraud
Who pays for a bad purchase made by an agent: the user, the agent’s developer, the merchant or the network? Signed mandates provide proof of authorization, but the split of liability when an agent is hijacked or misreads an intent is still unsettled. In Europe, strong customer authentication under PSD2, and soon under PSD3 and the PSR, will have to accommodate transactions initiated without direct human involvement.

Three issues draw the most attention. Security: agentic tokens keep the card number hidden, but they widen the attack surface to the agent itself and its secrets. Compliance: SCA, AML controls and traceability have to adapt to automated flows and huge volumes of tiny payments. Settlement: Mastercard says Agent Pay for Machines settles across multiple rails, stablecoins included, which builds one more bridge between traditional card payments and on-chain assets.

For France and the rest of Europe, the risk is ending up with a de facto standard built elsewhere. There is some good news. Adyen, Checkout.com and Getnet by Santander are already among the partners, and AP2’s open design leaves room for local schemes such as Cartes Bancaires (CB), France’s domestic card scheme, or account-to-account (A2A) solutions such as Wero to connect. Agentic payments are no longer a hypothesis. They are an infrastructure layer that is being wired in now.

Provenance

Published July 12, 2026

5 sources, 5 distinct domains

↗ Mastercard, Mastercard launches Agent Pay for Machines to unlock super-fast, always-on payments (press release, June 2026) · mastercard.com↗ Google Cloud, Announcing Agent Payments Protocol (AP2) · cloud.google.com↗ Visa, Visa Intelligent Commerce · visa.com↗ Stripe, Supporting additional payment methods for agentic commerce · stripe.com↗ Fortune, Mastercard launches protocol to let AI agents pay each other · fortune.com
← All news